[ADD] new moduled l10n_fr_certification (abstract / account / pos)

[legalsylvain]

This PR is a backport for Odoo 8.0 of l10n_fr_certification from Odoo CE 9.0, with a full refactor.
l10n_fr_certification has been splited into two modules :

• l10n_fr_certification_abstract that manage hash generation for any object

• l10n_fr_certification_account that manage certification for account module.

• The PR includes the module l10n_fr_certification_pos that is not covered for the time being by Odoo. See @qdp-odoo remarks here. 9.0 l10n fr inalterability qdp odoo/odoo#16935 (comment) The main objective of this module is to generate hash for Pos.order, print it on the bill, and prevent (optionaly) the print of the bill, if the server is offline, to avoid the use case described by @sebastienbeau here 9.0 l10n fr inalterability qdp odoo/odoo#16935 (comment).

Note : for the time being, there is a major bug in Odoo CE 9.0 (odoo/odoo#17671) that makes possible to changes accounting data without altering the hash computation. For that reason, the algorithm in the function _compute_l10n_fr_string_to_hash is not finished see here. I'm waiting the official fix, because i'd like to keep the same algorithm to generate hash as Odoo Core, to allow user to switch between OCA / 8.0 modules and Odoo / 9.0 (CE / Enterprise) module if they want.
Otherwise, this module is ready for review.

Please see the three readme for a detailled description.

• l10n_fr_certification_abstract
• l10n_fr_certification_account
• l10n_fr_certification_pos

CC : @sebastienbeau, @fclementic2c, @alexis-via.

Todo list

• backport possibility to work with other countries. (fd45cad)

UNALTERABLE_COUNTRIES = ['FR', 'MF', 'MQ', 'NC', 'PF', 'RE', 'GF', 'GP', 'TF']
Réf : ref https://github.com/odoo/odoo/pull/20581/files#diff-d5355a4d93d8bd7b81ab6649d9239385

• backport list of fields used for certification. (for account.move and pos.order) from 9.0 poscertif lpe odoo/odoo#20581

• Think about refactoring about holder, to feat with 9.0 poscertif lpe odoo/odoo#20581 PR. (sequences are unique for a company and a same object). This design is maybe more easy to implement. Waiting until the original PR is accepted.

[coveralls]

Coverage increased (+7.2%) to 52.941% when pulling 7bafa6c on grap:8.0_ADD_l10n_fr_certification_abstract_account_pos into 2197a8b on OCA:8.0.

[coveralls]

Coverage increased (+6.8%) to 52.58% when pulling a0fd717 on grap:8.0_ADD_l10n_fr_certification_abstract_account_pos into 2197a8b on OCA:8.0.

[coveralls]

Coverage increased (+6.8%) to 52.58% when pulling a0fd717 on grap:8.0_ADD_l10n_fr_certification_abstract_account_pos into 2197a8b on OCA:8.0.

[flotho]

Hi @legalsylvain , could you aslo precise if there is a strategy for the v10 in your dev?

regards

[flotho]

@legalsylvain ,

I think it will be necessary to track the modification of con on the POS. As the change of your option could be done by anybody having admin access right, we (odoo integrators) should be able to oppose the fact that somebody else than us made changes on the conf.
Do you agree with that ?

[legalsylvain]

Hi @flotho . Thanks for your review.

I think it will be necessary to track the modification of con on the POS.

No, if you set the configuration in the openerp file to a value different to legacy, it will not be possible to change the configuration in the pos config. (SAAS protection).

If you provides admin rights to users, he'll have the possibility to disable all protection, by many technical ways. The first one is to uninstall certification modules, but there are a lot of other ways (create server actions, installation new modules to cheat, etc...). And no modules will be able to assure you that admin (software) users / admin (server) users will not hack your apps. Admin has all rights, by design.

The spirit of the law is to make responsible software providers only if :

• the app provides "cheat" feature.
• The app provides features to alter existing sales. (cancel moves, etc...)

My PR provides mechanism to generate unique hash, based on sequence, previous sale hash, and datas sale and prevent cheating by "private mode in Firefox" by a soft (warning message on a 'uncertified bill') or a hard (prevent printing bill) mecanism.

If a user makes alterations of the tools, (changing non trivial configuration, altering code source, etc...) he becomes responsible of the changes, and so the integrators that provided the software is not responsible anymore. The law so protects Open Source integrators.

Ref :
http://april.org/loi-de-finances-2016-une-doctrine-fiscale-qui-reconnait-les-logiciels-libres-mais-avec-une-marge-de

Le paragraphe 300 du BOI définit ainsi comme « éditeur du logiciel ou du système de caisse la personne qui détient le code source du logiciel ou système et qui a la maîtrise de la modification des paramètres de ce produit. ». Le paragraphe 310 vient ensuite préciser que « lorsque le logiciel ou système est conçu de manière ouverte pour permettre son adaptation aux besoins spécifiques des clients » , l'éditeur est soit le concepteur d'origine si les modifications concernant les quatre conditions essentielles sont impossibles soit le dernier intervenant si « son intervention a eu pour objet ou effet de modifier un ou des paramètres permettant le respect des conditions d'inaltérabilité, de sécurisation, de conservation et d'archivage des données ».
Cette seconde option est importante puisqu'elle permet, sans restreindre la liberté de modification, à tout prestataire de fournir une attestation en tant qu'éditeur, tout en rompant le lien de responsabilité en cas de modification d'éléments non-triviaux du logiciel par l'utilisateur. L'utilisateur devient en ce cas lui-même l'éditeur, et doit alors faire certifier ou attester la conformité du logiciel ainsi modifié.

So, if an admin user disable all security features, he's responsible of that.

Hi @legalsylvain , could you aslo precise if there is a strategy for the v10 in your dev?

Not for the time being. I think that the planning could be :

• review this PR. (during the summer).
• backport @qdp-odoo fixes, concerning this bug. (l10n_fr_certification : Only the last line of the account.move is used to compute hash odoo/odoo#17671)
• porting for V10 / V11, once this PR accepted. (the port will be very easy about all algorithm. The only work is about porting JS feature. (i don't know exactly, maybe ~1 day, I didn't played with Odoo 10 PoS)

Did you have time to review more deeply the PR ? kind regards.

[flotho]

Hi @legalsylvain
Great news in your latest comment. I'll plan the test during this week.
I'll let you know.

[legalsylvain]

Hi @flotho. Did you taken time to review ?
thanks !

[flotho]

Hi @legalsylvain ,

I'll try to review this before the end of august

[legalsylvain]

@flotho And now ? -;)
regards.

[gaelTorrecillas]

Hello @legalsylvain ,

I have tested your module with the POS, and I share my results and ideas.

• I used the demo database.
  • I change the company location in france and the security has applied automatically on all POS of the company. it's a good idea, it works well
  • I can't close a session what was already opened before the previous changes.

I think we should prevent from changing the country if we have an opened pos session because if we continue to use this session, nothing will work correctly regarding to the french law.

[legalsylvain]

Hi @gaelTorrecillas. thanks for the test and review !

I can't close a session what was already opened before the previous changes.

I fiexed that with a3e2116

I added a new test. Thanks for the review.

CC : @flotho, @robinshakty

[coveralls]

Coverage increased (+6.9%) to 52.965% when pulling fd45cad on grap:8.0_ADD_l10n_fr_certification_abstract_account_pos into 72f75dd on OCA:8.0.

[coveralls]

Coverage increased (+6.9%) to 52.965% when pulling 5db336c on grap:8.0_ADD_l10n_fr_certification_abstract_account_pos into 72f75dd on OCA:8.0.

[coveralls]

Coverage increased (+6.9%) to 52.965% when pulling 06127ec on grap:8.0_ADD_l10n_fr_certification_abstract_account_pos into 72f75dd on OCA:8.0.

[yosva]

Hi!
What is the current state of this feature ?
How can I help to finish this task ?

[flotho]

Hi @legalsylvain ,

Is there any update on this module? Did you test the latest Odoo modules ?
regards

[legalsylvain]

closing this PR because no approval during long time and now V8.0 is now quite obsolete.

please review #126 v10.0 to have the same feature based on the official odoo module l10n_fr_pos_cert.

regards.